The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py executes commands using subprocess.Popen with shell=True. This allows for arbitrary shell command execution.
[PROMPT_INJECTION]: The SKILL.md instructions explicitly tell the agent not to read the source code of scripts before running them, which is a significant security anti-pattern.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection. * Ingestion points: Content is ingested via page.content() and page.locator().all() in automation scripts. * Boundary markers: None present. * Capability inventory: Shell execution via with_server.py and file writing via page.screenshot. * Sanitization: No sanitization of web content is performed.

webapp-testing